EMS HA installation with standalone remote database without Docker

The following uses PostgreSQL (Postgres) for the remote database. EMS and the Postgres database are hosted on two Ubuntu machines.

To configure the Postgres server:

1. Install Postgres 15 on the Postgres Ubuntu machine:

   sudo apt install -y --no-install-recommends curl ca-certificates
   sudo install -d /usr/share/postgresql-common/pgdg
   sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
   sudo sh -c 'echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
   sudo apt update
   sudo apt install -y postgresql-15

2. Install EMS custom extensions. The following commands require the ems_pg_extensions.tar.gz file, which you can download from the Fortinet Support site. Use the ems_pg_extensions.tar.gz file under the EMS 7.4.0 page to install extensions for EMS 7.4.1:

   sudo tar zxvf ems_pg_extensions.tar.gz -C /
   sh -c 'head -c 20 /dev/urandom | md5sum | head -c 20;' |sudo tee /var/lib/postgresql/15/symmetric_key.txt > /dev/null
   sudo systemctl restart postgresql

3. You can tune Postgres based on the specs of the host server by applying the recommended configuration. While there are various tools you can use to find the recommended configuration, these instructions use PGTune. Generate and copy the recommended configuration:
   1. Go to PGTune and enter the following information:

      Field	Value
      DB version	15
      OS Type	Linux
      DB Type	Online transaction processing system
      Total Memory (RAM)	Enter the total memory for your Postgres server. In this example, it is 4 GB.
      Number of CPUs	Enter the total number of CPUs for your Postgres server. In this example, it is 4.
      Number of Connections	1092
      Data Storage	Enter the data storage type as per your device. In this example, it is SSD storage.

   2. Click Generate.
   3. Click Copy configuration.

      

4. Update /etc/postgresql/15/main/postgresql.conf:

   1. Add or update the configuration in /etc/postgresql/15/main/postgresql.conf with the content that you copied in step 3.

      

   2. Uncomment and change wal_level to minimal, e.g. wal_level = minimal. This removes all logging except the information required to recover from a crash or immediate shutdown.

      

   3. Uncomment and change max_wal_senders to 0, e.g. max_wal_senders = 0. This disables replication.
   4. Uncomment and change listen_addresses to ‘*’, e.g. 'localhost' >> listen_addresses = '*'.
5. Give passwordless permission to the Postgres user on the same machine by changing /etc/postgresql/15/main/pg_hba.conf running:

   sed -i 's/# Database administrative login by Unix domain socket/\nhost all postgres 127.0.0.1\/32 trust\nhost all postgres ::1\/128 trust/' /etc/postgresql/15/main/pg_hba.conf

6. Allow connection from the remote machine by updating the following in pg_hba.conf:

   # IPv4 local connections:
   host all all 127.0.0.1/32 scram-sha-256 >> host all all 0.0.0.0/0 scram-sha-256

7. Restart the postgreSQL service:

   systemctl restart postgresql

8. Change the postgres user password:

   sudo -u postgres psql

   ALTER USER postgres PASSWORD 'Fortinet123#';

To configure EMS HA:

1. On both nodes, do the following:
   1. Download the forticlientems_7.4.1.XXXX.bin file from https://support.fortinet.com.
   2. Change permissions and add execute permissions to the installation file:

      sudo chmod +x forticlientems_7.4.1.XXXX.bin

2. On the primary node, install EMS:
   1. Set umask to 022 if the existing umask setting is more restrictive.
   2. Install EMS:

      sudo ./forticlientems_7.4.1.XXXX.bin -- --db_host "172.16.1.26" --db_user postgres --db_pass Fortinet123# --skip_db_install --allowed_hosts '*' --enable_remote_https

      Run the installer to/from any directory other than /tmp. Running the installer to/from /tmp causes issues.

      db_host is the remote Postgres server IP address.

   3. After installation completes, check that all EMS services are running by entering the following command:

      systemctl --all --type=service | grep -E 'fcems|apache|redis|postgres'

      

      The output shows that postgresql.service status displays as exited. This is the expected status. EMS does not create this service, which only exists to pass commands to version-specific Postgres services. It displays as part of the output as the command filters for all services that contain "postgres" in the name.

3. On the secondary node, install EMS:
   1. Set umask to 022 if the existing umask setting is more restrictive.
   2. Install EMS:

      sudo ./forticlientems_7.4.1.XXXX.bin -- --db_host "172.16.1.26" --db_user postgres --db_pass Fortinet123# --skip_db_install --skip_db_deploy --allowed_hosts '*' --enable_remote_https

      Run the installer to/from any directory other than /tmp. Running the installer to/from /tmp causes issues.

   3. After installation completes, check that EMS services are running by entering the following command. On the secondary EMS, only fcems_monitor, fcems_pgbouncer, fcems_wspgbouncer, and redis-server services should be running:

      systemctl --all --type=service | grep -E 'fcems|apache|redis|postgres'

4. After installation on both nodes is complete, access the EMS GUI from the primary node using a browser by going to https://localhost. Complete initial configuration for EMS by doing the following:

   1. Set the password for the default administrator. See Starting FortiClient EMS and logging in.

   2. Configure the EMS FQDN and remote access. See Configuring EMS after installation.

   3. License EMS. See Licensing FortiClient EMS.

5. Go to System Settings > EMS Settings.

6. In the Custom hostname field, enter a virtual IP address (VIP) that is configured in the FortiGate load balancer (LB) as the VIP for EMS. In this example, the VIP is 172.16.1.50.

7. Configure a FortiGate as an LB for EMS HA:

   1. Create a health check:
      1. Go to Policy & Objects > Health Check. Click Create New.

      2. For Type, select TCP.

      3. In the Interval field, enter 10.
      4. In the Timeout field, enter 2.
      5. In the Retry field, enter 3.

      6. In the Port field, enter 8013. Click OK.

   2. Create a virtual server:
      1. Go to Policy & Objects and create a virtual server.
      2. Configure the fields as follows:

         Field	Value
         Virtual server IP	VIP that you configured in step 6. In this example, the VIP is 172.16.1.50.
         Virtual server port	10443
         Load Balancing method	First Alive
         Health check	Monitor that you configured.

      3. Under Real Servers, select Create New.
      4. In the IPv4 address field, enter the primary EMS node IP address. In this example, it is 192.168.1.10.
      5. In the Port field, enter 10443.
      6. In the Max connections field, enter 0.
      7. For Mode, select Active.
      8. Create a real server for the secondary EMS node. Click Save.
   3. Repeat steps i-ix to create five additional virtual servers. The additional servers use ports 443, 8013, 8015, 8443, and 8871, but otherwise have identical settings to the first virtual server created. If you have enabled Chromebook management, create a virtual server for port 8443. Similarly, if you require importing an ACME certificate, create a virtual server for port 80.
   4. Create a security policy that includes the LB virtual server as a destination address:
      1. Go to Policy & Objects > Firewall Policy.
      2. Click Create New.
      3. Configure the Incoming Interface and Outgoing Interface fields. The outgoing interface connects to the primary EMS node.
      4. For Source, select all.
      5. In the Destination field, select ports 10443, 443, 8013, 8015, 8443, and 8871.
      6. For Service, select ALL.
      7. For Inspection Mode, select Proxy-based.
      8. Save the policy.
      9. If the EMS nodes are in different subnets, repeat these steps to configure a policy for the secondary EMS node. In this example, the nodes are in the same subnet, so you do not need to add a separate policy for the secondary EMS.

8. After the FortiGate LB configuration is complete, you can access EMS using the VIP configured in the FortiGate LB. If after initially installing EMS 7.4.1 you need to upgrade to a newer build, repeat steps 1-3 with the new installation file.